The auth type '${enforcedType}' is enforced, but no authenti

Error message

The auth type '${enforcedType}' is enforced, but no authentication is configured.

What it means

Thrown from the same enforced-auth branch as error 165, but for the more specific case where an `enforcedType` is configured yet the caller has *no* effective auth type at all — neither config nor environment provides any credential. The branch fires because `enforcedType` is set and `effectiveAuthType` is falsy, so the message states that the enforced type exists but nothing is configured to satisfy it.

Source

Thrown at packages/cli/src/validateNonInterActiveAuth.ts:34

import { validateAuthMethod } from './config/auth.js';
import { handleError } from './utils/errors.js';
import { runExitCleanup } from './utils/cleanup.js';

export async function validateNonInteractiveAuth(
  configuredAuthType: AuthType | undefined,
  useExternalAuth: boolean | undefined,
  nonInteractiveConfig: Config,
  settings: LoadedSettings,
) {
  try {
    const effectiveAuthType = configuredAuthType || getAuthTypeFromEnv();

    const enforcedType = settings.merged.security.auth.enforcedType;
    if (enforcedType && effectiveAuthType !== enforcedType) {
      const message = effectiveAuthType
        ? `The enforced authentication type is '${enforcedType}', but the current type is '${effectiveAuthType}'. Please re-authenticate with the correct type.`
        : `The auth type '${enforcedType}' is enforced, but no authentication is configured.`;
      throw new Error(message);
    }

    if (!effectiveAuthType) {
      const message = `Please set an Auth method in your ${USER_SETTINGS_PATH} or specify one of the following environment variables before running: GEMINI_API_KEY, GOOGLE_GENAI_USE_VERTEXAI, GOOGLE_GENAI_USE_GCA`;
      throw new Error(message);
    }

    const authType: AuthType = effectiveAuthType;

    if (!useExternalAuth) {
      const err = await validateAuthMethod(String(authType));
      if (err != null) {
        throw new Error(err);
      }
    }

    return authType;
  } catch (error) {

View on GitHub (pinned to 5024443c72)

Solutions

Authenticate with the method matching `enforcedType` — run the appropriate interactive login flow first.
Set the matching environment variable for the enforced type (e.g. `GEMINI_API_KEY` if enforced type is `gemini-api-key`).
If enforcement is unintended, remove or correct `security.auth.enforcedType` in the responsible settings file.
Verify the merged settings to confirm which layer (user vs project) is contributing the enforcement.

Example fix

# before — enforcedType set, no creds anywhere
$ gemini -p 'hi'  # throws

# after — provide matching creds
$ GEMINI_API_KEY=xxxx gemini -p 'hi'  # if enforcedType is gemini-api-key

Defensive patterns

Strategy: validation

Validate before calling

function assertAuthPresent(
  enforcedType: string | undefined,
  effectiveType: string | undefined,
) {
  if (enforcedType && !effectiveType) {
    throw new Error(`Auth '${enforcedType}' is enforced but not configured.`);
  }
}

const enforced = settings.merged.security.auth.enforcedType;
const effective = configuredAuthType ?? getAuthTypeFromEnv();
assertAuthPresent(enforced, effective);

Type guard

function isAuthConfiguredForEnforced(
  enforced: string | undefined,
  effective: string | undefined,
): boolean {
  return !enforced || Boolean(effective);
}

Try / catch

try {
  await validateNonInteractiveAuth(configuredAuthType, useExternalAuth, cfg, settings);
} catch (e) {
  if (e instanceof Error && e.message.includes('no authentication is configured')) {
    // route user to the login flow for the enforced type
  }
  throw e;
}

Prevention

Provision credentials for the enforced type before first run; document this in onboarding.
Use a preflight check in deploy scripts to fail before the CLI does, with a clearer message.
Keep enforcedType and the provisioning playbook versioned together.

When it happens

Trigger: Calling `validateNonInteractiveAuth` with `security.auth.enforcedType` populated while `configuredAuthType` is empty and `getAuthTypeFromEnv()` returns nothing (no `GEMINI_API_KEY`, no Vertex flag, no GCA flag, no prior OAuth).

Common situations: Fresh checkout on a new machine where policy enforces a type but the user never ran interactive login; env vars accidentally cleared by a shell reset; an enforced type was added by an admin but onboarding docs weren't updated; running in a container with a fresh home dir.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of google-gemini/gemini-cli@5024443c72 (2026-08-12). Data as JSON: /api/errors/505c88948bd1038b. Report an issue: GitHub.